oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	² 2	³	⁴
⁵ 5	⁶ 2	⁷ 2	⁸ 1	⁹ 2	¹⁰ 1	¹¹
¹² 4	¹³ 1	¹⁴ 2	¹⁵ 1	¹⁶ 5	¹⁷ 2	¹⁸ 6
¹⁹ 9	²⁰ 4	²¹ 3	²² 15	²³ 5	²⁴ 2	²⁵ 2
²⁶ 2	²⁷ 5	²⁸	²⁹ 5	³⁰ 1

Messages by day:

April 1 (1 message)

Re: kopano-core 11.0.1: Remote DoS by memory exhaustion (Jan Engelhardt <jengelh@...i.de>)

April 2 (2 messages)

kopano-core 11.0.1.77: Remote DoS with out-of-bounds access (Jan Engelhardt <jengelh@...i.de>)
CVE-2021-22696: Apache CXF: OAuth 2 authorization service vulnerable to DDos attacks (Colm O hEigeartaigh <coheigea@...che.org>)

April 5 (5 messages)

Re: Risk of local privilege escalation in GNU Guix (Leo Famulari <leo@...ulari.name>)
Re: Risk of local privilege escalation in GNU Guix (Henri Salo <henri@...v.fi>)
Re: Risk of local privilege escalation in GNU Guix (Jan Engelhardt <jengelh@...i.de>)
Re: Risk of local privilege escalation in GNU Guix (Leo Famulari <leo@...ulari.name>)
Re: Risk of local privilege escalation in GNU Guix (Leo Famulari <leo@...ulari.name>)

April 6 (2 messages)

Django: CVE-2021-28658: Potential directory-traversal via uploaded files (Mariusz Felisiak <felisiak.mariusz@...il.com>)
CVE-2021-29136: umoci: malicious layer with symlink entry for "/" allows overwriting of host files (Aleksa Sarai <cyphar@...har.com>)

April 7 (2 messages)

CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver (马哲宇 <zheyuma97@...il.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

April 8 (1 message)

[CVE-2021-29154] Linux kernel incorrect computation of branch displacements in BPF JIT compiler can be abused to execute arbi… (Piotr Krysiuk <piotras@...il.com>)

April 9 (2 messages)

Re: Risk of local privilege escalation in GNU Guix (Leo Famulari <leo@...ulari.name>)
Re: Linux kernel: Exploitable vulnerabilities in AF_VSOCK implementation (Alexander Popov <alex.popov@...ux.com>)

April 10 (1 message)

Re: Risk of local privilege escalation in GNU Guix (Leo Famulari <leo@...ulari.name>)

April 12 (4 messages)

CVE-2021-29425 (Possible limited path traversal in Apache Commons IO 2.2 to 2.6) (Jochen Wiedmann <jochen.wiedmann@...il.com>)
CVE-2021-29943: Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections (Mike Drob <mdrob@...che.org>)
CVE-2021-29262: Apache Solr: Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settin… (Mike Drob <mdrob@...che.org>)
CVE-2021-27905: Apache Solr: SSRF vulnerability with the Replication handler (Mike Drob <mdrob@...che.org>)

April 13 (1 message)

X.Org server security advisory: April 13, 2021 (Matthieu Herrb <matthieu@...rb.eu>)

April 14 (2 messages)

[kubernetes] CVE-2021-25735: Validating Admission Webhook does not observe some previous fields (Tim Allclair <timallclair@...il.com>)
CVE-2021-20288 Ceph: Unauthorized global_id reuse in cephx (Ana McTaggart <amctagga@...hat.com>)

April 15 (1 message)

CVE-2021-27850: Apache Tapestry: Bypass of the fix for CVE-2019-0195 ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)

April 16 (5 messages)

[CVE-2021-3493] Ubuntu Linux kernel overlayfs fs caps privilege escalation (Steve Beattie <steve.beattie@...onical.com>)
[CVE-2021-3492] Ubuntu shiftfs Linux kernel file system double free vulnerability (Steve Beattie <steve.beattie@...onical.com>)
QEMU: ESP security fixes (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: [CVE-2021-3493] Ubuntu Linux kernel overlayfs fs caps privilege escalation (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [CVE-2021-3493] Ubuntu Linux kernel overlayfs fs caps privilege escalation (Steve Beattie <steve.beattie@...onical.com>)

April 17 (2 messages)

xscreensaver package caps gets raw socket (Tavis Ormandy <taviso@...il.com>)
Re: xscreensaver package caps gets raw socket (Tavis Ormandy <taviso@...il.com>)

April 18 (6 messages)

Re: xscreensaver package caps gets raw socket (Érico Nogueira <ericonr@...root.org>)
CVE-2021-23133: Linux kernel: race condition in sctp sockets (Or Cohen <orcohen@...oaltonetworks.com>)
Re: xscreensaver package caps gets raw socket (Simon McVittie <smcv@...ian.org>)
[CVE-2021-29155] Linux kernel protection for sequences of pointer arithmetic operations against speculatively out-of-bounds l… (Piotr Krysiuk <piotras@...il.com>)
Re: xscreensaver package caps gets raw socket (Solar Designer <solar@...nwall.com>)
Re: xscreensaver package caps gets raw socket (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 19 (9 messages)

Announce: OpenSSH 8.6 released (Damien Miller <djm@....openbsd.org>)
Re: Linux Kernel: out of bounds array access in dm-ioctl.c (- Nop <nopitydays@...il.com>)
Re: xscreensaver package caps gets raw socket ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: xscreensaver package caps gets raw socket (Solar Designer <solar@...nwall.com>)
Re: xscreensaver package caps gets raw socket (Ariadne Conill <ariadne@...eferenced.org>)
Re: xscreensaver package caps gets raw socket ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: xscreensaver package caps gets raw socket (Ariadne Conill <ariadne@...eferenced.org>)
Re: xscreensaver package caps gets raw socket (Eli Schwartz <eschwartz@...hlinux.org>)
Re: xscreensaver package caps gets raw socket (Stuart Henderson <stu@...cehopper.org>)

April 20 (4 messages)

Linux kernel: a heap buffer overflow in firedtv driver ("Luo Likang" <luolikang@...ocus.com>)
DNS rebinding vulnerability in npupnp (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)
Vulnerability in Jenkins (Daniel Beck <ml@...kweb.net>)
DNS rebinding vulnerability in pupnp (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

April 21 (3 messages)

Exim security update ahead (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: xscreensaver package caps gets raw socket (Salvatore Bonaccorso <carnil@...ian.org>)

April 22 (15 messages)

Malicious commits to Linux kernel as part of university study (Peter Bex <peter@...e-magic.net>)
Re: Malicious commits to Linux kernel as part of university study (Albert Veli <albert.veli@...il.com>)
Re: Malicious commits to Linux kernel as part of university study (Peter Bex <peter@...e-magic.net>)
Re: Malicious commits to Linux kernel as part of university study ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Malicious commits to Linux kernel as part of university study (David H <ispcolohost@...il.com>)
Re: Malicious commits to Linux kernel as part of university study (Marcus Meissner <meissner@...e.de>)
Re: Malicious commits to Linux kernel as part of university study (Marcus Meissner <meissner@...e.de>)
Re: Malicious commits to Linux kernel as part of university study (Santiago Torres <torresariass@...il.com>)
Re: Malicious commits to Linux kernel as part of university study (Ariadne Conill <ariadne@...eferenced.org>)
Re: Malicious commits to Linux kernel as part of university study (Ariadne Conill <ariadne@...eferenced.org>)
Re: Malicious commits to Linux kernel as part of university study (r00t4dm <r00t4dm@...il.com>)
Re: Malicious commits to Linux kernel as part of university study (Mark Steward <marksteward@...il.com>)
Re: Malicious commits to Linux kernel as part of university study (Michael Orlitzky <michael@...itzky.com>)
Re: Malicious commits to Linux kernel as part of university study (Francis Booth <influencedchaos@...il.com>)
Re: Malicious commits to Linux kernel as part of university study (Eric Biggers <ebiggers@...nel.org>)

April 23 (5 messages)

Re: Malicious commits to Linux kernel as part of university study (Jan Engelhardt <jengelh@...i.de>)
Re: Malicious commits to Linux kernel as part of university study (Kurt H Maier <khm@...ops.net>)
Re: Malicious commits to Linux kernel as part of university study (Greg KH <greg@...ah.com>)
Re: Malicious commits to Linux kernel as part of university study (James Feister <openjaf@...il.com>)
CVE-2021-26291: Apache Maven: block repositories using http by default (Brian Fox <brianf@...che.org>)

April 24 (2 messages)

Re: Malicious commits to Linux kernel as part of university study (Silas <silas.cutler@...cklistthisdomain.com>)
Re: Malicious commits to Linux kernel as part of university study (Thomas Ward <teward@...mas-ward.net>)

April 25 (2 messages)

Re: kopano-core 11.0.1.77: Remote DoS with out-of-bounds access (Robert Scheck <robert@...oraproject.org>)
Re: DNS rebinding vulnerability in npupnp (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

April 26 (2 messages)

virtualbox: CVE-2021-2264: vboxautostart-service.sh allows injection of parameters in 'su' invocation (Matthias Gerstner <mgerstner@...e.de>)
virtualbox: CVE-2021-25319: missing sticky bit in openSUSE packaging for /etc/box allows local root exploit for members o… (Matthias Gerstner <mgerstner@...e.de>)

April 27 (5 messages)

CVE-2020-17517: Apache Ozone: Ozone S3 Gateway allows bucket and key access to non authenticated users (Bharat Viswanadham <bharat@...che.org>)
CVE-2021-28125: Apache Superset Open Redirect (daniel gaspar <danielvazgaspar@...il.com>)
CVE-2021-30638: An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and late… ("Thiago H. de Paula Figueiredo" <thiago…)
[CVE-2021-29200] RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI ("jleroux@...che.org" <jleroux@...che.org>)
[CVE-2021-30128] Unsafe deserialization in OFBiz ("jleroux@...che.org" <jleroux@...che.org>)

April 29 (5 messages)

ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) (Michael McNally <mcnally@....org>)
Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) (Ariadne Conill <ariadne@...eferenced.org>)
Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) (Ondřej Surý <ondrej@....org>)
Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) (Ariadne Conill <ariadne@...eferenced.org>)
Nitro Enclaves kernel driver issue ("Paraschiv, Andra-Irina" <andraprs@...zon.com>)

April 30 (1 message)

[ANNOUNCE] klibc 2.0.9 (Ben Hutchings <ben@...adent.org.uk>)

90 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.